@howard: "  This is probably easier than I am making it, but my googlefu seems to be
failing me at the moment when I look around.   I  handle a batch of FreeBSD
servers running sendmail, and I am having a site that is trying to deliver
mail being rejected, but they swear their DNS is right, so I am not sure if
we have an issue, or they do.
 I am seeing sendmail rejects like this:
Sep 20 14:45:59 mail3 mail3-smtp[15388]: r8JE8kQg099367:
to=<email_address>, delay=1+04:37:10, xdelay=00:00:31,
mailer=esmtp, pri=5259883, relay=smtp2.panini.co.uk., dsn=4.0.0,
stat=Deferred: Name server: smtp2.panini.co.uk.: host name lookup failure
 If I take and run a host lookup, I get a response like this:
$ host panini.co.uk             
panini.co.uk mail is handled by 10 smtp.panini.co.uk.
panini.co.uk mail is handled by 20 smtp2.panini.co.uk.
Now if I try that on any of the hosts that should accept the mail, I see:
$ host smtp.panini.co.uk
smtp.panini.co.uk is an alias for smtp.panini.it.
smtp.panini.it has address 83.161.120.155
Host smtp.panini.it not found: 3(NXDOMAIN)
$ host smtp2.panini.co.uk
smtp2.panini.co.uk is an alias for smtp2.panini.it.
smtp2.panini.it has address 83.161.120.155
Host smtp2.panini.it not found: 3(NXDOMAIN)
 So I get the IP address returned, but then an NXDOMAIN that follows.   I do
have the BrokenAAAA config option in my sendmail, so know it's not that, or
I don't think so.    Yet if I do a dig on the hosts, they seem to come back
with an IP address as expected, and shown above.
 So if anyone can offer a clue on this, it would be appreciated..
-
Howard Leadmon "
    @carl: "-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
<quote>
dig smtp2.panini.it. +trace +nodnssec
smtp2.panini.it.    3600    IN  NS  paninirad3.panini.it.
smtp2.panini.it.    3600    IN  NS  paninirad2.panini.it.
smtp2.panini.it.    3600    IN  NS  paninirad1.panini.it.
;; Received 167 bytes from 83.161.120.155#53(dns2.quadrante.com) in 652 ms
smtp2.panini.it.    0   IN  A   83.161.120.155
;; Received 49 bytes from 83.161.120.155#53(paninirad3.panini.it) in 197
ms
quadrante.com delegates that to paninirad*.panini.it, but those servers
don't know about the delegation.
-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.14 (GNU/Linux)
iEYEARECAAYFAlI81vAACgkQL6j7milTFsFyyQCfXx69caeSURZDNRUwXgJfdGNO
r6EAnj00YxjhLcwTU4WywaITjwHqbn/f
=7+ph
-END PGP SIGNATURE-"
    @howard: " Thanks, but wait why am I getting resolution of the IP back?   Is that
actually not valid, and it should be drilling down further but can't?
-
Howard Leadmon
<quote>
unsubscribe"
    @marka: "In message <henry78@example.com>, "Howard Leadmon" writ
es:
<quote>
Firstly MX records are not supposed to point to CNAME records.  The
MX records need to be updated.
Secondly and more importantly they have a misconfigured load balancer
that is returning bad answers.  The last answer to "dig +trace
smtp2.panini.it aaaa" should be "smtp2.panini.it. 86400 IN SOA
paninirad1.panini.it. administrator.panini.it".
Note the SOA record needs to be from the zone delegated (smtp2.panini.it)
to the load balancer.
They need to contact their load balancer vendor for proper instructions
on how to configure it. 
Mark
% dig +trace smtp2.panini.it aaaa
; <<>> DiG 9.10.0a1 <<>> +trace smtp2.panini.it aaaa
;; global options: +cmd
.			518400	IN	NS	f.root-servers.net.
.			518400	IN	NS	c.root-servers.net.
.			518400	IN	NS	k.root-servers.net.
.			518400	IN	NS	d.root-servers.net.
.			518400	IN	NS	l.root-servers.net.
.			518400	IN	NS	i.root-servers.net.
.			518400	IN	NS	h.root-servers.net.
.			518400	IN	NS	b.root-servers.net.
.			518400	IN	NS	e.root-servers.net.
.			518400	IN	NS	m.root-servers.net.
.			518400	IN	NS	g.root-servers.net.
.			518400	IN	NS	a.root-servers.net.
.			518400	IN	NS	j.root-servers.net.
.			518400	IN	RRSIG	NS 8 0 518400 20130927000000 20130919230000 49656 . U9k2KFpbNYnY4EfyKzla26XbharLoAQtkQG02oq3aHVnM3OlLp6lmBdT wgMDcShAQJxIk50krHlIuoyOGHHuJ56P6ubFiGBRU0V4OOt2/V8emJZx U6MRMDwDyTweZbfNZiiK20T5RVlUK/PLI3YbbcYxxtSCKzV2fThLxi3F /x4=
;; Received 397 bytes from 83.161.120.155#53(83.161.120.155) in 3 ms
it.			172800	IN	NS	a.dns.it.
it.			172800	IN	NS	c.dns.it.
it.			172800	IN	NS	m.dns.it.
it.			172800	IN	NS	r.dns.it.
it.			172800	IN	NS	dns.nic.it.
it.			172800	IN	NS	nameserver.cnr.it.
it.			86400	IN	NSEC	je. NS RRSIG NSEC
it.			86400	IN	RRSIG	NSEC 8 1 86400 20130927000000 20130919230000 49656 . A01ecU1p6o7U4le9Jh8F2aQ4fl9XdPFMcERxLf2cZ6aiHkKsZdQsHiwN eI/5VnC9N1sLgF9p8uD7H8adMjC/EFHDK/kXmbpJNps9Hi/VdYa846He tu4iYxmQpaq0SgIpCqsRSRk0TjnL0l0B/VZueZREvpEQND6Zjjys7Zow ZvE=
;; Received 610 bytes from 83.161.120.155#53(h.root-servers.net) in 352 ms
panini.it.		10800	IN	NS	dns1.quadrante.com.
panini.it.		10800	IN	NS	dns2.quadrante.com.
;; Received 108 bytes from 888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a416#53(c.dns.it) in 200 ms
smtp2.panini.it.	3600	IN	NS	paninirad3.panini.it.
smtp2.panini.it.	3600	IN	NS	paninirad2.panini.it.
smtp2.panini.it.	3600	IN	NS	paninirad1.panini.it.
;; Received 167 bytes from 83.161.120.155#53(dns2.quadrante.com) in 410 ms
panini.it.		86400	IN	SOA	panini.it. administrator.panini.it. 998545544 28800 7200 604800 86400
^^^^^^^^^^ is WRONG!!!!!!!!!!!
;; Received 110 bytes from 83.161.120.155#53(paninirad3.panini.it) in 341 ms
%
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: (269)531-0068                 INTERNET: <email_address>"
    @howard: " Many thanks Mark, I was staring at this scratching my head, but that made
it very clear, and I will pass this along.   Glad to see it's not something
I botched up on my side..
-
Howard Leadmon 
<quote>
be
FreeBSD
deliver
if
failure
see:
I
back
ms
unsubscribe"
    @kcd: ""host" performs A, AAAA and MX queries, by default. If you want to limit 
it to a specific query type, use the "-t" option.
Having said that, I didn't get an NXDOMAIN for any of the query types, 
from any of the delegated nameservers, when using dig, but I'm getting 
SERVFAILs when using host, *after* the initial A-record query (as seen 
in debug mode). I'm not that familiar with "host" to be able to 
troubleshoot this very easily. The 0-second-TTL on the record probably 
isn't helping. It seems likely (rad = Radware, probably) that it's 
actually load-balancing devices answering these queries, rather than 
actual nameservers.
Last but not least, it's not legal to point an MX record at an *alias*, 
and that's probably the root cause of your main problem (sendmail 
failures) here...
                                     - Kevin
<quote>"
    @marka: "In message <henry78@example.com>, "Howard Leadmon" writ
es:
<quote>
Because the load balancer is misconfigured.  It has the wrong zone name
configured into it.  On top of that the nameserver behind the load balancer
is also misconfigured.  The A and AAAA queries come from load balancer.
The TXT answer comes from the nameserver behind the load balancer.
Mark
; <<>> DiG 9.10.0a1 <<>> smtp2.panini.it @paninirad3.panini.it +norec a
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17526
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;smtp2.panini.it.		IN	A
;; ANSWER SECTION:
smtp2.panini.it.	0	IN	A	83.161.120.155
;; Query time: 413 msec
;; SERVER: 83.161.120.155#53(83.161.120.155)
;; WHEN: Sat Sep 21 09:35:34 EST 2013
;; MSG SIZE  rcvd: 49
; <<>> DiG 9.10.0a1 <<>> smtp2.panini.it @paninirad3.panini.it +norec aaaa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12789
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;smtp2.panini.it.		IN	AAAA
;; AUTHORITY SECTION:
panini.it.		86400	IN	SOA	panini.it. administrator.panini.it. 998545544 28800 7200 604800 86400
;; Query time: 421 msec
;; SERVER: 83.161.120.155#53(83.161.120.155)
;; WHEN: Sat Sep 21 09:35:41 EST 2013
;; MSG SIZE  rcvd: 110
; <<>> DiG 9.10.0a1 <<>> smtp2.panini.it @paninirad3.panini.it +norec txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34596
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;smtp2.panini.it.		IN	TXT
;; Query time: 365 msec
;; SERVER: 83.161.120.155#53(83.161.120.155)
;; WHEN: Sat Sep 21 09:35:51 EST 2013
;; MSG SIZE  rcvd: 33
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: (269)531-0068                 INTERNET: <email_address>"
{'source': 'USENET', 'other_information': '{"reply_count": 6, "forum_name": "comp.protocols.dns.bind.20150130.mbox"}', 'file': 'data/output/usenet-comp.protocols.parquet'}